CORS configuration with Flask-CORS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when accessing a Flask route with CORS enabled for all origins?

Consider a Flask app with Flask-CORS configured to allow all origins. What will be the value of the Access-Control-Allow-Origin header in the response when a browser sends a cross-origin request?

Flask

from flask import Flask
from flask_cors import CORS

app = Flask(__name__)
CORS(app)

@app.route('/')
def home():
    return 'Hello World!'

# Assume a browser sends a cross-origin GET request to '/'

A "Access-Control-Allow-Origin" header is set to "*"

B "Access-Control-Allow-Origin" header is missing

C "Access-Control-Allow-Origin" header is set to the requesting origin only if it matches a whitelist

D "Access-Control-Allow-Origin" header is set to "null"

💡 Hint

Think about what happens when you enable CORS without restrictions.

When Flask-CORS is initialized with default settings (CORS(app)), it allows all origins by setting the Access-Control-Allow-Origin header to '*'. This means any website can access the resource.

📝 Syntax

intermediate

Which Flask-CORS configuration syntax correctly restricts CORS to only 'https://example.com'?

You want to configure Flask-CORS to allow cross-origin requests only from 'https://example.com'. Which code snippet correctly achieves this?

A CORS(app, origins='https://example.com')

B CORS(app, origins=['https://example.com'])

C CORS(app, origin='https://example.com')

D CORS(app, allow_origin='https://example.com')

💡 Hint

Check the parameter name and its expected type in Flask-CORS docs.

The correct parameter is 'origins' and it expects a list or string. Using a list with one origin is the recommended way.

🔧 Debug

advanced

Why does this Flask-CORS setup fail to add CORS headers to a blueprint route?

Given the code below, why does the route '/api/data' not include CORS headers in the response?

Flask

from flask import Flask, Blueprint, jsonify
from flask_cors import CORS

app = Flask(__name__)
cors = CORS(app, resources={r"/api/users/*": {"origins": "*"}})

api_bp = Blueprint('api', __name__, url_prefix='/api')

@api_bp.route('/data')
def data():
    return jsonify({'key': 'value'})

app.register_blueprint(api_bp)

A The route returns a dictionary instead of a string, causing CORS headers to be skipped

B CORS was applied to app but not explicitly to the blueprint, so blueprint routes lack CORS headers

C The origins pattern in resources is incorrect and does not match '/api/data'

D The blueprint was registered after CORS initialization, so CORS does not apply to it

💡 Hint

Check if the resource pattern matches the full request path including the blueprint url_prefix.

Flask-CORS only adds CORS headers for request paths that match the specified resource patterns. The pattern r'/api/users/*' does not match '/api/data', so no CORS headers are added.

🧠 Conceptual

advanced

What is the effect of setting 'supports_credentials=True' in Flask-CORS?

In Flask-CORS, what does setting the parameter supports_credentials=True do to the CORS response headers?

A It adds the header 'Access-Control-Allow-Credentials: true' allowing cookies and credentials in cross-origin requests

B It sets 'Access-Control-Allow-Origin' to '*' regardless of origin

C It disables CORS for all routes to prevent credential leaks

D It automatically adds authentication headers to all responses

💡 Hint

Think about how browsers handle cookies and credentials in cross-origin requests.

Setting supports_credentials=True adds the Access-Control-Allow-Credentials header with value true, which tells browsers to allow sending cookies and credentials in cross-origin requests.

❓ state_output

expert

What is the value of the 'Access-Control-Allow-Origin' header after this Flask-CORS configuration?

Given the Flask app below, what will be the value of the 'Access-Control-Allow-Origin' header in the response to a cross-origin request from 'https://evil.com'?

Flask

from flask import Flask
from flask_cors import CORS

app = Flask(__name__)
CORS(app, origins=["https://trusted.com", "https://partner.com"])

@app.route('/')
def home():
    return 'Welcome!'

# A browser from 'https://evil.com' sends a cross-origin request to '/'

A 'Access-Control-Allow-Origin' is set to 'https://trusted.com'

B 'Access-Control-Allow-Origin' is set to 'https://evil.com'

C 'Access-Control-Allow-Origin' is set to '*'

D No 'Access-Control-Allow-Origin' header is included in the response

💡 Hint

Consider how Flask-CORS handles origins not in the allowed list.

If the request origin is not in the allowed origins list, Flask-CORS does not add the Access-Control-Allow-Origin header, so the browser blocks the response for cross-origin requests.